The Borrowed Masthead - Decipon Insights

The Operation That Just Ran

Seven days ago, Armenians voted in parliamentary elections. Nikol Pashinyan’s pro-European Civil Contract party won with approximately 50 percent of the vote — a result that gave his party 64 of 105 parliamentary seats.

What they voted through was documented in research reports, fact-checks, and intelligence assessments that had been accumulating since March: one of the largest state-sponsored disinformation campaigns ever recorded against a single election. Researchers at EU DisinfoLab, CivilNet, Myth Detector, and European Parliament research offices documented 343 fake videos produced in the period leading to the June 7 vote — second in scale only to the campaign Russia ran against Moldova’s 2025 election.

The network that produced them is called Matryoshka.

What Matryoshka Is

Matryoshka has been active since 2023. Researchers describe it as the largest and most sophisticated pro-Kremlin disinformation network currently operating. Its signature is not original content. It is brand theft.

The network’s technique is producing short vertical videos — the format native to TikTok, Instagram Reels, and X — bearing the visual identity of established Western media outlets. CNN logo. Reuters banner. Bloomberg watermark. Euronews branding. Politico header. The actual content is fabricated. The logos are real.

The name is apt: the Russian nesting doll, layers within layers, each containing the same structure. Fake content wrapped in real branding, distributed through bot accounts to simulate amplification, sometimes seeded directly to journalists and fact-checkers with requests for “verification.” That last maneuver generates media coverage of the denial — which guarantees the original fabricated claim reaches audiences who would never have sought it.

The Armenia campaign started in March. By early May, 343 videos had been tracked. The research was ongoing.

What the Videos Said

The narratives targeted Pashinyan personally and framed his pro-European policy direction as existential threat.

The war story. The dominant claim across dozens of videos: Pashinyan’s pivot toward the EU and NATO would provoke a war with Russia. On May 11, a Matryoshka video bearing a fake CNN logo claimed Pashinyan’s press secretary had confirmed the presence of NATO military instructors in Armenia and that he would “provoke a military conflict with Russia” after the election. The framing is consistent with messaging Russia deploys across every country it targets for reorientation: pivot West, and the war follows you.

The gas chambers. One fabrication claimed Pashinyan was building gas chambers on Mount Ararat. No source. No evidence. No retraction needed. A claim this extreme does not require belief — it requires only that the phrase enter circulation. Audiences who encounter it and do not fact-check it carry some version of it forward. The goal is not factual persuasion. It is moral contamination.

The Macron deal. Multiple fake videos, documented in a joint investigation by CivilNet and the Antibot4Navalny network, promoted the claim that Pashinyan and French President Macron had struck a “secret deal”: French electoral backing in exchange for Armenia launching a war against Russia after a Pashinyan victory. The frame is geopolitical betrayal — Pashinyan is not merely wrong, he is sold out; the product of a Western transaction that will produce Armenian casualties.

The assassination calls. Matryoshka-distributed deepfakes contained explicit calls to kill Pashinyan. This exceeds the typical influence operation mandate of undermining political support. Whether this represents centrally controlled intent or insufficiently supervised content generation, it marks a threshold. The network distributes incitement within the same pipeline as electoral disinformation.

Brand laundering at scale. CivilNet documented fake Matryoshka content bearing the logos of CNN, Reuters, Bloomberg, Euronews, Politico, Libération, and local Armenian outlets. One video bore the CivilNet logo itself — the investigative outlet documenting the operation used as a distribution vehicle for the operation. The fact-checker’s masthead authenticated the fabrication.

Why Logos Work

The core mechanism Matryoshka exploits is cognitive shortcutting under information load.

No one evaluates every piece of information from first principles. The human brain applies source-reliability heuristics quickly and automatically, before deliberative processing begins. Visual brand identity is one of the strongest of those heuristics. A CNN chyron signals that the content behind it has been through a newsroom, through editors, through institutional accountability. The response is fast and precognitive. By the time conscious evaluation begins, the credibility stamp has already been applied.

Matryoshka short-circuits this by providing the stamp without the institution. The CNN logo activates the credibility heuristic. The content behind it is fabricated. The heuristic fires before the content is evaluated.

This is distinct from writing fake news on an unfamiliar domain. A fake article on an unknown site asks the audience to evaluate an unknown source. A fake video with a CNN logo asks the audience to override a credibility signal they already trust. That override is possible, but it requires effort. Most information encounters do not trigger deliberate, effortful processing. The default is: logo present, credibility heuristic applied.

The short vertical video format amplifies this. Short-form video is processed faster than text, with higher emotional activation and lower critical engagement. The combination of trusted logo, emotionally charged content about war and assassination, and short-form delivery is calibrated to maximize automatic processing and minimize deliberative scrutiny.

What Broke It

Pashinyan won. The operation did not prevent that outcome.

Saturation creates recognition. The Moldova 2025 campaign was similarly large and similarly failed. Audiences who have seen this pattern before — who watched a previous election run the same playbook — develop informal recognition heuristics. A sudden flood of videos claiming their prime minister is building gas chambers, all bearing Western logos, in the months before a vote, does not read as a series of independent news reports. It reads as a pattern with a specific origin.

Counter-documentation was public and early. Myth Detector, CivilNet, EU DisinfoLab, and European Parliament researchers published detailed analyses while the operation was still running. By May, the Matryoshka technique had been named, documented, and reported in English and Armenian. Voters who cared to know they were being targeted had access to that knowledge before election day. Counter-information ran parallel to disinformation rather than chasing it afterward.

The opposition could not convert it. Disinformation is not self-executing. It requires a domestic political actor capable of converting manufactured doubt into electoral preference change. Armenia’s opposition — primarily associated with the pre-2018 political order and the 2020 military defeat in Nagorno-Karabakh — lacked the credibility to make Matryoshka’s frame persuasive. Pashinyan’s weaknesses are real and documented; the opposition’s ability to exploit them was constrained by its own history.

Western institutional support arrived in advance. The EU allocated €12 million to Armenian resilience efforts, including anti-disinformation support, before the election. The distinction matters. This is not retroactive cleanup after the operation ran. It is counter-capability deployed while the operation was active.

What “Failed” Actually Means

The framing of this as an operation that failed deserves scrutiny.

The immediate goal — preventing Pashinyan from winning — was not achieved. But the goals of an influence operation at this scale are not limited to whether the target loses.

Information space degradation. Even a failed influence operation leaves residue. Some number of Armenians who encountered Matryoshka content without fact-checking it carry some version of these narratives. The gas chambers claim does not require belief to be useful — it requires only that it is somewhere in the environment, available to be recirculated when political circumstances change.

Capability testing. Three hundred and forty-three documented fake videos is not primarily a tool for winning one election. It is a capability demonstration. Which narratives achieved spread. Which logo combinations produced the highest engagement. Which seeding strategies generated media coverage. The next operation benefits from this data.

Narrative pre-positioning. The “Armenia will go to war with Russia if it pivots West” framing, even if it did not move the electorate in June 2026, is now planted and available. Should a future border incident, diplomatic crisis, or adverse event occur, the pre-laid narrative that Pashinyan’s European policy leads to this can be redeployed without reconstruction. The infrastructure is in place.

Signaling to other audiences. Russian domestic media can report this operation as a defensive response to Western interference in Armenia. The capability demonstration — 343 videos — is legible to a domestic audience regardless of whether it succeeded against its external target.

Influence Tactics Breakdown

Authority Laundering. Using the visual identity of credible Western institutions — CNN, Reuters, Bloomberg — to transfer institutional credibility to fabricated content. The logo activates the credibility heuristic before deliberative evaluation can begin. The borrowed authority is not built through consistent, accurate reporting; it is copied from institutions that built it over decades and applied to authenticate its opposite. When the fact-checker’s own logo is used to validate a fabrication about the fact-checker’s subject, the laundering is complete.

War Frame Injection. Systematically associating a pro-Western political pivot with the prediction of armed conflict, targeting the specific anxiety most salient to a population with a recent history of military defeat. Armenia’s 2020 experience makes the war frame functionally precise — audiences who processed that loss are calibrated to weight this particular threat more heavily. The campaign did not choose this narrative randomly. It was selected for the specific vulnerability in this specific electorate.

Fact-Check Seeding. Systematically sending fabricated content to journalists and fact-checking organizations with requests for verification, guaranteeing that denials generate coverage of the original claim. The denial is the amplification. The audience reached by the debunking is larger than the bot-seeded original would have reached independently; and a significant fraction of that audience retains the original claim more effectively than the correction. The operation used the fact-check infrastructure as its primary distribution channel.

Deepfake Escalation. Including calls to kill the targeted political leader within fabricated video content marks a threshold in what the network considers acceptable output. Whether this represents centrally controlled intent or unsupervised content generation, it defines the current operating ceiling of Matryoshka: electoral disinformation and political incitement run in the same pipeline.

Narrative Pre-Positioning. Planting specific narrative frames in advance of potential future events that could activate them. The operation is not designed only for June 7. It is building infrastructure for future information campaigns against the same target, with frames that become more credible if adverse events materialize to fit them. The planted narrative waits.

After the Vote

Pashinyan won. The operation ran and the election delivered its result.

But the record should be precise about what that means. The Armenian electorate voted through 343 documented fake videos, a voter-transportation scheme designed to bus Russian-Armenians across the border to swing the result, deepfakes including assassination calls against the sitting prime minister, and documented economic coercion threats tied to electoral outcomes.

That they voted the way they voted is not evidence that the operation was ineffective in all its dimensions. It is evidence that under specific conditions — early public documentation, counter-capability deployed in advance, an opposition unable to convert manufactured doubt, and an electorate with prior exposure to the pattern — operations of this kind are less effective than they might otherwise be.

Those conditions are not universal. They are not guaranteed.

They are built. Usually at significant cost. Usually after having learned their value the hard way.

The nesting doll opened, and it was full of CNN logos. This time, not enough people were fooled. The question for the next election — different electorate, weaker counter-capability, an opposition ready and willing to convert the content — is whether those conditions will be in place.

This article is part of Decipon’s Manipulation Breakdowns series, examining specific influence operations through the Influence Tactics Protocol.

Sources: